OWASP API8 2023 Define Error Responses 401 (Edit)

OWASP API Security recommends defining schemas for all responses, even errors. The 401 describes what happens when a request is unauthorized, so it is important to define this for documentation and contract testing.

OWASPSecurityResponsesAuthenticationOpenAPI

Rule Definition

owasp-api8-2023-define-error-responses-401-warn.yaml 
{"owasp-api8-2023-define-error-responses-401-warn":{"description":"OWASP API Security recommends defining schemas for all responses, even errors. The 401 describes what happens when a request is unauthorized, so it is important to define this for documentation and contract testing.","message":"Operation is missing a 401 error response.","given":"$.paths..responses","severity":"warn","then":{"field":"401","function":"truthy"}}}

Back to All of the Rules